Описание
Jenkins Matrix Authorization Strategy Plugin 2.6.1 and earlier does not escape user names shown in the configuration, resulting in a stored cross-site scripting vulnerability.
A flaw was found in the Matrix Authorization Strategy Plugin version 2.6.1 and prior. User names are not escaped in the permission table which could lead to a stored cross-site scripting (XSS) vulnerability. The user must have the Agent/Configure, Job/Configure, or Overall/Administer permissions for this exploit to function. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Дополнительная информация
Статус:
EPSS
8 High
CVSS3
Связанные уязвимости
Jenkins Matrix Authorization Strategy Plugin 2.6.1 and earlier does not escape user names shown in the configuration, resulting in a stored cross-site scripting vulnerability.
Stored XSS vulnerability in Jenkins Matrix Authorization Strategy Plugin
EPSS
8 High
CVSS3